diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index e864b3b..52e11e1 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -1,7 +1,14 @@
 name: Secret scan
 
 on:
+  # `push` is scoped to main deliberately. Unscoped, every push to a topic branch scanned it once
+  # and the pull_request event scanned the same commits again moments later — two runs per change,
+  # visible on every Dependabot branch. The `concurrency` group below does not collapse them: the
+  # push run keys on `github.ref` while the PR run keys on the PR number, so they land in different
+  # groups. Branch work stays covered by `pull_request`; main keeps its own run because that is the
+  # one scanning all reachable history after a merge.
   push:
+    branches: [main]
   pull_request:
   merge_group:
   workflow_dispatch: